August 2001 - Test - lists.nanog.org

Fwd: Re: Code Red variants
by Jeff Ogden 05 Aug '01

05 Aug '01

FYI >Date: Sat, 04 Aug 2001 20:16:55 -0700 >To: Jeff Ogden <jogden(a)merit.edu> >From: John Moore <misclists(a)tinyvital.com> >Subject: Re: Code Red variants > >At 07:48 PM 8/4/2001, you wrote: > >>Do we know if anyone has looked at the code for variants of the >>worn in detail recently? I've seen announcements about new >>versions with better random IP address generation. Does anyone >>know if other aspects of the worm are the same? Is it still set to >>spread itself until the 19th and then switch to attacking the IP >>address that was once www1.whitehouse.gov or are their variants >>with different dates and different IP address or attack scenarios? > > >Jeff, > I tried sending info to the list but may not have posting >priveleges. Anyway, you can relay this. > >I have a home system on Sprint Broadband, with a little sniffer on >port 80 to see the full payload of what is coming in. Starting this >morning a new variant of CodeRed started hitting, with a lot more >frequency than I ever saw from the original. > >This variant has the text "CodeRedII" in the payload. It also has >the names of the windows registry entries you would want to hit to >install a rebootable trojan. It does not have any domain name in it, >and nothing about "Hacked by Chinese." It has XXXXXXXXXXXXXXXXXXX in >the payload instead of NNNNNNNNNNNNNNn > >The class A domain with by far the greatest number of hits belongs to Sprint. > >I dumped some statistics on which class A prefixes had at least >three hits. I also dumped the total number of CodeRedII hits by hour. > >I don't have time to disassemble it - I am just watching out of >curiousity, so I don't know what else it is doing. > >here are my hourly stats so far. Time is GMT. > >08040113 1 >08040114 4 >08040115 10 >08040116 5 >08040117 13 >08040118 10 >08040119 12 >08040120 9 >08040121 18 >08040122 15 >08040123 16 >08050100 18 >08050101 20 >08050102 26 > >Here is the domain breakdown: >Class A # > 168 3 > 112 3 > 249 3 > ? 21 > 221 80 > 43 3 > 190 4 > >Feel free to mention this to the list if you want, since my mail is >not getting through. > >Thanks > >John > > > > >John Moore > >john(a)tinyvital.com - http://www.tinyvital.com/ >Tiny Vital Software, Inc > >The only good weather is bad weather! >Storm Chasing - the Best extreme sport! > >(SKYWARN,ARRL,AZ AMS,AZTC,NJ7E)

3 2

CodeRedII worm..
by Valdis.Kletnieks＠vt.edu 05 Aug '01

05 Aug '01

Given that initial analysis of the CodeRedII worm indicates that it leaves a backdoor laying around, I hereby request that those people who made lists of infected hosts available last time *NOT* do so again. Although said lists *were* helpful in the analysis and study of the worm's tactics, the benefits are certainly outweighted by the fact that the new worm creates a known backdoor. I'm certain that both the CodeRedII author and other black hats would love for us to compile a list of afflicted hosts for them to use. So please everybody - if you're sending IP's in to be added to a table, make sure you're sending them to a white hat, not to a black hat who's managed to social-engineer you. If you're a white had compiling a list, make sure the guy's hat is at least a light grey before you give them a copy. ;) Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 1

Code Red variants
by Lou Katz 05 Aug '01

05 Aug '01

I'm seeing about 2:1 "XXXXXXXXXXXX" vs "NNNNNNNNNNNN" entries in today's logs. Also, I have over a factor of 20 more entries in Aug than in July. -- -=[L]=-

6 5

This new CodeRedII is moving way faster than the previous
by Chris Grout 05 Aug '01

05 Aug '01

This thing is hitting hard! I got bored and thought I'd through some stats/info together... So far, since 9:16am on 7/19, I've seen 485 CRv1 attacks from 257 unique IPs on my cable modem. Since 6:49am today, I've been hit 472 times from 133 unique IPs with this new "CRv2" worm. - All infected systems seem to try each scanned IP twice whereas the original only tried once, which probably will help its infection rate. Seems odd though as both tries use the same source port. Could just be my snort rules... - It has the word "CodeRedII" hard coded in the packet, so its obviously a copycat or at least a fairly recent revision. - *Appears* to be hardcoded to use the d:\inetpub\scripts and d:\progra~1 \common~1\system\MSADC directories. Assuming you are not using this path, are you still vulnerable? - Either copies cmd.exe or creates a new file named root.exe in those directories. - I'm seeing almost only cable modem systems now. Appears businesses may have finally gotten their acts together. chris

1 0

RE: Code Red Hammering Away
by Roeland Meyer 05 Aug '01

05 Aug '01

> From: William Allen Simpson [mailto:wsimpson@greendragon.com] > Sent: Saturday, August 04, 2001 4:45 PM > It seems to me that somebody needs to write a version of Code > Red that > wipes all .exe and .dll in the windows directory, forcing an update > of both windows and office. > > Anybody game? Only if you're willing to cover all contingent liabilities and indemnify all parties involved. (that was a joke<g>)

1 0

NANOG 23 Meeting Information
by Carol Wadsworth 04 Aug '01

04 Aug '01

Registration is now *open* for the 23rd Meeting of the North American Network Operators' Group. The meeting will be held October 21-23 at the Oakland Marriott City Center in Oakland, California, and will be hosted by Cisco Systems. Online Registration URL: https://www.merit.edu/nanog/registration.form.html.0110 Hotel Information URL: http://www.nanog.org/mtg-0110/hotel.html *********************************************************** CALL FOR PRESENTATIONS NANOG 23 October 21-23, 2001 The North American Network Operators' Group (NANOG) will hold its 23rd meeting in Oakland, CA, between October 21-23, 2001. The meeting will be hosted by Cisco Systems. NANOG conferences provide a forum for the coordination and dissemination of technical information related to large-scale (i.e., national/international) Internet backbone networking technologies and operational practices. NANOG meetings, held three times each year, include two days of short presentations, plus afternoon/evening tutorial sessions. Meetings are informal, with an emphasis on relevance to current backbone engineering practices. The conference draws over 600 participants, mainly consisting of engineering staff from large national service providers, and members of the research and education community. The meeting will be held at the Oakland Marriott City Center. For more information about NANOG meetings, schedules, and logistics, see: http://www.nanog.org --------------------------------------------------------- CALL FOR PRESENTATIONS The special theme for NANOG23 is Backbone Security. We invite presentations on security topics, including IPSec, traffic filtering, DoS, and configuration and protection of the backbone infrastructure. In addition to the themed security session, NANOG also invites presentations on topics related to backbone engineering and operations. Previous meetings have included presentations on: - Backbone traffic engineering - Coordination of inter-provider QoS - Inter-provider security and routing protocol authentication - Routing scalability in backbone infrastructures - Routing policy specification and backbone router configuration - Building large-scale measurement infrastructure - Cooperative inter-provider caching - Alternatives to hot-potato routing - Recommendations on queue management and congestion avoidance - Experience with differentiated services - Inter-domain multicast deployment - Backbone network failure analysis Tutorials have covered topics such as: - BGP case studies - MPLS fundamentals - IP multicast technologies - ISPs and federal privacy law --------------------------------------------------------- HOW TO PRESENT Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is September 10, 2001. While the majority of speaking slots will be filled by September 10, a limited number of slots will be available after that date for topics that are exceptionally timely and important. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by September 24, 2001. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics.

2 1

RE: Code Red Hammering Away
by Joe Blanchard 04 Aug '01

04 Aug '01

Better yet debug -f cs:0000 FFFF 00 -w cs:0000 1 0 100 -q lol. >It seems to me that somebody needs to write a version of Code Red that >wipes all .exe and .dll in the windows directory, forcing an update >of both windows and office. >Anybody game? >-- >William Allen Simpson

1 0

RE: Code Red Hammering Away
by Joe Blanchard 04 Aug '01

04 Aug '01

Yeap seeing XXXXXs as of 04/Aug/2001:06:40:51 PST. As well, no decrease in the amount of traffic scanning for port 80 off a /16 network. -Joe

1 0

Re: Its not a worm, just Mother Nature
by Kyle C. Bacon 04 Aug '01

04 Aug '01

There was also a fire in the basement of a telco hotel in Cleveland, OH due to a blown/over-extended transformer. The building was evacuated and power to the building was shut off by the Fire Department between 9am and 1pm EST. There was no damage to any telco equipment in the building that I know of. K Sean Donelan <sean@donelan To: nanog(a)merit.edu .com> cc: Sent by: Subject: Its not a worm, just Mother Nature owner-nanog@m erit.edu 08/03/2001 03:53 PM Yesterday, Chicago and the midwest was hit by severe thunderstorms. Power was disrupted in several cities, and even now at least one provider still recovering somewhere in the Detroit, Chicago, Cleveland area. Today, Florida is getting hit with a tropical storm. A couple of providers seem to have a few connectivity problems. Pretty much another day on the Internet.

3 2

Re: Its not a worm, just Mother Nature
by Sean Donelan 04 Aug '01

04 Aug '01

On Fri, 03 August 2001, "Kyle C. Bacon" wrote: > There was also a fire in the basement of a telco hotel in > Cleveland, OH due to a blown/over-extended transformer. The building > was evacuated and power to the building was shut off by the Fire > Department between 9am and 1pm EST. According to news reports the Keith Building at East 17th and Euclid is a 20 story, high-rise building. Both the main fire alarm and the its backup failed, so no fire alarm sounded. Damage seems to be limited to the basement, and smoke damage as it rose through shafts and ducts in the building. > There was no damage to any telco equipment in the building > that I know of. PSI.net had some circuits down, but I haven't heard of any damage to telco equipment. I don't know how many other providers had equipment in the same building.

2 1